Detection rules › By event

RPCFW

Event	Rules
Event ID 3	17

Event ID 3

17 detection rules reference this event. View event page.

Sigma (17)

Possible DCSync Attack severity high T1033
Recon Activity via SASec severity high
Remote DCOM/WMI Lateral Movement severity high T1021, T1021.003, T1047
Remote Encrypting File System Abuse severity high
Remote Event Log Recon severity high
Remote Printing Abuse for Lateral Movement severity high
Remote Registry Lateral Movement severity high T1112
Remote Registry Recon severity high
Remote Schedule Task Lateral Movement via ATSvc severity high T1053, T1053.002
Remote Schedule Task Lateral Movement via ITaskSchedulerService severity high T1053, T1053.002
Remote Schedule Task Lateral Movement via SASec severity high T1053, T1053.002
Remote Schedule Task Recon via AtScv severity high
Remote Schedule Task Recon via ITaskSchedulerService severity high
Remote Server Service Abuse severity high
Remote Server Service Abuse for Lateral Movement severity high T1569, T1569.002
SharpHound Recon Account Discovery severity high T1087
SharpHound Recon Sessions severity high T1033